Free Website Security Audit & SSL Checker

It runs a limited external probe of a public site: the TLS certificate, six security response headers (HSTS, CSP, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, Permissions-Policy), the disclosed Server header, and seven common TCP ports.

No. It is a non-intrusive external probe that reads publicly visible signals only. It does not exploit anything, log in, or scan for CVEs, and it cannot prove a site is secure or that it is compromised.

Add the missing headers at your web server or CDN edge. Start with HSTS (Strict-Transport-Security), X-Content-Type-Options: nosniff, and a Referrer-Policy, then build a Content-Security-Policy, which is the hardest to configure safely.

HSTS (HTTP Strict-Transport-Security) is a response header telling browsers to always use HTTPS for your domain, preventing protocol-downgrade and cookie-hijacking attacks. A good baseline is max-age of at least 31536000 seconds (one year).

The OWASP Secure Headers baseline includes Strict-Transport-Security, Content-Security-Policy, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy. The checker reports which of these six are present, missing, or misconfigured.

A detailed Server header (naming software and version) hands attackers a version fingerprint to match against known exploits. Suppressing or genericising it via server config removes an easy reconnaissance signal, though it is hardening, not a real fix.

A certificate check alone confirms encryption is valid and unexpired. This scan reads the certificate too, but adds response headers, the Server banner, and open ports, giving a broader external hardening snapshot rather than a single trust signal.

Ideally only the ports you intend to serve publicly (typically 443, and 80 for redirects) respond. Exposed database, remote-desktop, or admin ports on a public host are worth reviewing and firewalling off.

No. A clean external probe means these specific public signals look healthy. It says nothing about application logic, authentication, unpatched software, or server-side vulnerabilities, so treat it as one input, not a certificate of security.

Google favours HTTPS, and browsers flag insecure pages, hurting trust and click-through. Valid TLS and hardening headers protect users from tampering and mixed-content warnings, supporting the safe-browsing signals that underpin sustainable search visibility.